You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
command line program provided as part of the JDK. For example:
109
119
110
120
```bash
111
121
keytool -importcert -trustcacerts -file <path to certificate authority file>
112
-
-keystore <path to trust store> -storepass <password>
122
+
-keystore <path to trust store> -storepass <trust store password>
113
123
```
124
+
125
+
#### Set the Default Key Store
126
+
114
127
A typical application will also need to set several JVM system
115
-
properties to ensure that the client presents an TLS/SSL certificate to the
128
+
properties to ensure that the client *presents* an TLS/SSL [client certificate](https://docs.mongodb.com/manual/tutorial/configure-ssl/#set-up-mongod-and-mongos-with-client-certificate-validation) to the
116
129
MongoDB server:
117
130
118
131
-`javax.net.ssl.keyStore`
119
-
The path to a key store containing the client's TLS/SSL certificates
132
+
The path to a key store containing the client's TLS/SSL certificates
-out <path to key store> -passout pass:<trust store password>
150
+
```
128
151
129
152
For more information on configuring a Java application for TLS/SSL, please
130
-
refer to the [`JSSE Reference Guide`](http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSS
131
-
ERefGuide.html).
153
+
refer to the [`JSSE Reference Guide`]({{< javaseref "technotes/guides/security/jsse/JSSERefGuide.html" >}}).
154
+
155
+
156
+
### Forcing TLS 1.2
157
+
158
+
Some applications may want to force only the TLS 1.2 protocol. To do this, set the `jdk.tls.client.protocols` system property to "TLSv1.2".
159
+
160
+
Java runtime environments prior to Java 8 started to enable the TLS 1.2 protocol only in later updates, as shown in the previous section. For the driver to force the use of the TLS 1.2 protocol with a Java runtime environment prior to Java 8, ensure that the update has TLS 1.2 enabled.
161
+
162
+
163
+
### OCSP
164
+
165
+
{{% note %}}
166
+
The Java driver cannot enable OCSP by default on a per MongoClient basis.
167
+
{{% /note %}}
168
+
169
+
#### Client-driven OCSP
170
+
171
+
An application will need to set JVM system and security properties to ensure that client-driven OCSP is enabled:
172
+
173
+
-`com.sun.net.ssl.checkRevocation`:
174
+
When set to `true`, this system property enables revocation checking.
175
+
176
+
-`ocsp.enable`:
177
+
When set to `true`, this security property enables client-driven OCSP.
178
+
179
+
To configure an application to use client-driven OCSP, the application must already be set up to connect to a server using TLS. Setting these system properties is required to enable client-driven OCSP.
180
+
181
+
{{% note %}}
182
+
The support for TLS provided by the JDK utilizes “hard fail” behavior in the case of an unavailable OCSP responder in contrast to the mongo shell and drivers that utilize “soft fail” behavior.
183
+
{{% /note %}}
184
+
185
+
#### OCSP Stapling
186
+
187
+
{{% note class="important" %}}
188
+
The following exception may occur when using OCSP stapling with Java runtime environments that use the TLS 1.3 protocol (Java 11 and higher use TLS 1.3 by default):
189
+
190
+
`javax.net.ssl.SSLHandshakeException: extension (5) should not be presented in certificate_request`
191
+
192
+
The exception is due to a known issue with TLS 1.3 in Java 11 and higher. To avoid this exception when using a Java runtime environments using the TLS 1.3 protocol, you can force the application to use the TLS 1.2 protocol. To do this, set the `jdk.tls.client.protocols` system property to "TLSv1.2".
193
+
{{% /note %}}
194
+
195
+
An application will need to set several JVM system properties to set up OCSP stapling:
196
+
197
+
-`jdk.tls.client.enableStatusRequestExtension`:
198
+
When set to `true` (its default value), this enables OCSP stapling.
199
+
200
+
-`com.sun.net.ssl.checkRevocation`:
201
+
When set to `true`, this enables revocation checking. If this property is not set to `true`, then the connection will be allowed to proceed regardless of the presence or status of the revocation information.
202
+
203
+
To configure an application to use OCSP stapling, the application must already be set up to connect to a server using TLS, and the server must be set up to staple an OCSP response to the certificate it returns as part of the the TLS handshake.
204
+
205
+
For more information on configuring a Java application to use OCSP, please
206
+
refer to the [`Client-Driven OCSP and OCSP Stapling`]({{< javaseref "technotes/guides/security/jsse/ocsp.html" >}}).
command line program provided as part of the JDK. For example:
99
109
100
110
```bash
101
111
keytool -importcert -trustcacerts -file <path to certificate authority file>
102
-
-keystore <path to trust store> -storepass <password>
112
+
-keystore <path to trust store> -storepass <trust store password>
103
113
```
114
+
115
+
#### Set the Default Key Store
116
+
104
117
A typical application will also need to set several JVM system
105
-
properties to ensure that the client presents an TLS/SSL certificate to the
118
+
properties to ensure that the client *presents* an TLS/SSL [client certificate](https://docs.mongodb.com/manual/tutorial/configure-ssl/#set-up-mongod-and-mongos-with-client-certificate-validation) to the
106
119
MongoDB server:
107
120
108
121
-`javax.net.ssl.keyStore`
109
-
The path to a key store containing the client's TLS/SSL certificates
122
+
The path to a key store containing the client's TLS/SSL certificates
-out <path to key store> -passout pass:<trust store password>
140
+
```
118
141
119
142
For more information on configuring a Java application for TLS/SSL, please
120
-
refer to the [`JSSE Reference Guide`](http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSS
121
-
ERefGuide.html).
143
+
refer to the [`JSSE Reference Guide`]({{< javaseref "technotes/guides/security/jsse/JSSERefGuide.html" >}}).
144
+
145
+
146
+
### Forcing TLS 1.2
147
+
148
+
Some applications may want to force only the TLS 1.2 protocol. To do this, set the `jdk.tls.client.protocols` system property to "TLSv1.2".
149
+
150
+
Java runtime environments prior to Java 8 started to enable the TLS 1.2 protocol only in later updates, as shown in the previous section. For the driver to force the use of the TLS 1.2 protocol with a Java runtime environment prior to Java 8, ensure that the update has TLS 1.2 enabled.
151
+
152
+
153
+
### OCSP
154
+
155
+
{{% note %}}
156
+
The Java driver cannot enable OCSP by default on a per MongoClient basis.
157
+
{{% /note %}}
158
+
159
+
#### Client-driven OCSP
160
+
161
+
An application will need to set JVM system and security properties to ensure that client-driven OCSP is enabled:
162
+
163
+
-`com.sun.net.ssl.checkRevocation`:
164
+
When set to `true`, this system property enables revocation checking.
165
+
166
+
-`ocsp.enable`:
167
+
When set to `true`, this security property enables client-driven OCSP.
168
+
169
+
To configure an application to use client-driven OCSP, the application must already be set up to connect to a server using TLS. Setting these system properties is required to enable client-driven OCSP.
170
+
171
+
{{% note %}}
172
+
The support for TLS provided by the JDK utilizes “hard fail” behavior in the case of an unavailable OCSP responder in contrast to the mongo shell and drivers that utilize “soft fail” behavior.
173
+
{{% /note %}}
174
+
175
+
#### OCSP Stapling
176
+
177
+
{{% note class="important" %}}
178
+
The following exception may occur when using OCSP stapling with Java runtime environments that use the TLS 1.3 protocol (Java 11 and higher use TLS 1.3 by default):
179
+
180
+
`javax.net.ssl.SSLHandshakeException: extension (5) should not be presented in certificate_request`
181
+
182
+
The exception is due to a known issue with TLS 1.3 in Java 11 and higher. To avoid this exception when using a Java runtime environments using the TLS 1.3 protocol, you can force the application to use the TLS 1.2 protocol. To do this, set the `jdk.tls.client.protocols` system property to "TLSv1.2".
183
+
{{% /note %}}
184
+
185
+
An application will need to set several JVM system properties to set up OCSP stapling:
186
+
187
+
-`jdk.tls.client.enableStatusRequestExtension`:
188
+
When set to `true` (its default value), this enables OCSP stapling.
189
+
190
+
-`com.sun.net.ssl.checkRevocation`:
191
+
When set to `true`, this enables revocation checking. If this property is not set to `true`, then the connection will be allowed to proceed regardless of the presence or status of the revocation information.
192
+
193
+
To configure an application to use OCSP stapling, the application must already be set up to connect to a server using TLS, and the server must be set up to staple an OCSP response to the certificate it returns as part of the the TLS handshake.
194
+
195
+
For more information on configuring a Java application to use OCSP, please
196
+
refer to the [`Client-Driven OCSP and OCSP Stapling`]({{< javaseref "technotes/guides/security/jsse/ocsp.html" >}}).
0 commit comments